Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
118 results · page 1 of 3
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-104143 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-104142 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-104141 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-102756 · Other software · dataease · reported by GitHubMedium 5.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-102755 · Other software · dataease · reported by GitHubMedium 5.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A flaw has been found in DataEase up to 3.0.0.CVE-2026-108824 · Other software · reported by VulDBLow 2.1
A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 18, 2026SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify othCVE-2026-93660 · Other software · dataease · reported by VulnCheckHigh 7.1
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-53557 · Other software · dataease · reported by GitHubHigh 7.7
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe identifier handling. When the same datasource is later removed through DELETE /api/v1/datasource/{id}, the stored value is interpolated into datasource cleanup SQL and executed by PostgreSQL. This second-order SQL injection can invoke PostgreSQL COPY TO PROGRAM and execute arbitrary operating-system commands with the privileges of the postgres process inside the SQLBot container. This issue is fixed in version 1.9.0.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-53556 · Other software · dataease · reported by GitHubMedium 6
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for SQLBot's internal PostgreSQL service and submit a crafted table_name that remains a SELECT operation under the read-only policy while invoking pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default tested trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response and potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-53555 · Other software · dataease · reported by GitHubMedium 5.1
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-53554 · Other software · dataease · reported by GitHubHigh 7.3
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes the content before spreadsheet parsing and validation finish, and can transform a double-extension filename into a Python source file. An attacker able to submit a crafted multipart upload can use these behaviors to place attacker-controlled content in /opt/sqlbot/app/alembic/versions/ even when a spreadsheet parsing failure after the file write causes the endpoint to return an error. The planted file remains on disk, and subsequent SQLBot startup or migration processing causes Alembic to import the module and execute its module-level statements in the SQLBot application runtime. This issue is fixed in version 1.9.0.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResCVE-2023-40772 · Other software · DataEase · reported by MITREMedium 4.3
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
- Product
- DataEase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2026A vulnerability has been found in DataEase up to 2.10.25/2.10.26.CVE-2026-90529 · Other software · reported by VulDBMedium 5.1
A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument canvasViewInfo[*].customAttr.tooltip.backgroundColor leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026DataEase before 2.10.26 contains multiple access control defects in the sharing link module.CVE-2026-82879 · Other software · dataease · reported by VulnCheckMedium 5.3
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing CVE-2026-82878 · Other software · dataease · reported by VulnCheckMedium 5.3
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45532 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the `FILE_SEPARATOR` is `\`, while the server only filters the `/` character during string truncation. The vulnerability has been fixed in v2.10.23. No known workarounds are available.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE outpCVE-2026-72743 · Other software · dataease · reported by VulnCheckMedium 5.1
SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that executes for all users viewing the dashboard.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-50124 · Other software · dataease · reported by GitHubHigh 7.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip through the Excel upload API /datasource/upload, creating an H2 datasource that uses the zip: protocol, and executing an SQL dataset path where CalciteProvider.jdbcFetchResultField calls statement.executeQuery(), causing precompiled Java aliases in test.mv.db to execute arbitrary code. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-50030 · Other software · dataease · reported by GitHubHigh 7.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-49867 · Other software · dataease · reported by GitHubMedium 6.3
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-46684 · Other software · dataease · reported by GitHubCritical 9.5
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45535 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as ${var} and SqlparserUtils.handleVariableDefaultValue() inserts them with String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45534 · Other software · dataease · reported by GitHubCritical 9
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext so com.amazon.redshift.Driver#connect, com.amazon.redshift.Driver#getJdbcIniFile, and com.amazon.redshift.util.ObjectFactory#instantiate execute a reflection-based remote code execution chain during a normal JDBC connection through io.dataease.datasource.type.Redshift. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45533 · Other software · dataease · reported by GitHubHigh 8.3
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of arbitrary server directories through export task cleanup. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45419 · Other software · dataease · reported by GitHubHigh 8.5
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageService#save, StaticResourceServer#saveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing path traversal and arbitrary file writes because only / was used when extracting the file name. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45417 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-45320 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace("${var}", value) splices it into dashboard SQL, allowing authenticated users who can view a dashboard to inject SQL against integrated datasources. This issue is fixed in version 2.10.23
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-57172 · Other software · dataease · reported by GitHubHigh 8.3
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs, bypass TokenFilter verification, and access backend resources as the share creator even if the original share has been revoked. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-55647 · Other software · dataease · reported by GitHubMedium 5.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-55635 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-55633 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-55631 · Other software · dataease · reported by GitHubHigh 7.2
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-53751 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous parameters such as init in malicious H2 JDBC connection strings and achieve arbitrary code execution. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-53730 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute arbitrary SQL statements, and read sensitive core data. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-53729 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-50530 · Other software · dataease · reported by GitHubHigh 7.1
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026DataEase is an open source data visualization and analysis tool.CVE-2026-50529 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials. This issue is fixed in version 2.10.24.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2026A security flaw has been discovered in Dataease 2.10.20.CVE-2026-8724 · Other software · Dataease · reported by VulDBLow 2
A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component Data Dashboard. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
- Product
- Dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-42463 · Other software · dataease · reported by GitHubHigh 8.6
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Object Reference) and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces. This vulnerability is fixed in 1.8.0.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.CVE-2026-33324 · Other software · dataease · reported by GitHubCritical 9.4
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1.
- Product
- SQLBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-40901 · Other software · dataease · reported by GitHubHigh 7.5
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using ObjectInputStream with no deserialization filter or class allowlist. An authenticated attacker who can write to the Quartz job table, such as through the previously described SQL injection in previewSql, can replace a scheduled job's JOB_DATA with a malicious CommonsCollections6 gadget chain payload. When the Quartz cron trigger fires, the payload is deserialized and executes arbitrary commands as root inside the container, achieving full remote code execution. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-40900 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-40899 · Other software · dataease · reported by GitHubHigh 8.3
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contains the JDBC security blocklist. When a datasource configuration is submitted as JSON, Jackson deserialization calls setIllegalParameters with an attacker-supplied empty list, replacing the blocklist before getJdbc() validation runs. This allows an authenticated attacker to include dangerous JDBC parameters such as allowLoadLocalInfile=true, and by pointing the datasource at a rogue MySQL server, exploit the LOAD DATA LOCAL INFILE protocol feature to read arbitrary files from the DataEase server filesystem, including sensitive environment variables and database credentials. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-33207 · Other software · dataease · reported by GitHubHigh 8.6
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. Although DatasourceServer.java validates that the table name exists in the datasource, an attacker can bypass this by first registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation check. An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-33122 · Other software · dataease · reported by GitHubHigh 8.6
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted configuration is passed to DatasourceSyncManage.createEngineTable, where it is substituted into a CREATE TABLE statement template without any sanitization or identifier escaping. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-33121 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-33084 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, which is passed to Order2SQLObj where it is incorporated into the SQL ORDER BY clause without any whitelist validation, and then executed via CalciteProvider. An authenticated attacker can inject arbitrary SQL commands through the sort parameter, enabling time-based blind SQL injection. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open-source data visualization and analytics platform.CVE-2026-33083 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoints including /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLObj class directly assigns the raw user-supplied orderDirection value into the SQL query without any validation or whitelist enforcement, and the value is rendered into the ORDER BY clause via StringTemplate before being executed against the database. An authenticated attacker can inject arbitrary SQL commands through the sorting direction field, enabling time-based blind data extraction and denial of service. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026DataEase is an open source data visualization analysis tool.CVE-2026-33082 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset export functionality. The expressionTree parameter in POST /de2api/datasetTree/exportDataset is deserialized into a filtering object and passed to WhereTree2Str.transFilterTrees for SQL translation, where user-controlled values in "like" filter terms are directly concatenated into SQL fragments without sanitization. An attacker can inject arbitrary SQL commands by escaping the string literal in the filter value, enabling blind SQL injection through techniques such as time-based extraction of database information. This issue has been fixed in version 2.10.21.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026A vulnerability was determined in Dataease SQLbot up to 1.6.0.CVE-2026-5417 · Other software · Dataease · reported by VulDBLow 2
A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.0 is capable of addressing this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure.
- Product
- SQLbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.